NetScaler and nested Groups. nFactor first is User...
# citrix-netscalerj
Julian Jakob
03/27/2024, 3:24 PMNetScaler and nested Groups. nFactor first is UsernameOnly with LDAPS No-Auth Policy, Nested Groups is enabled (max two levels) and my Authlog is confirming, all the nested groups I am member of are shown correctly "Nested group extraction done for user julian"
Now for the next factor, a NO_AUTHN Auth-Policy with the expression AAA.USER.IS_MEMBER_OF("NestedGroup1") is bound. The problem is, that policy never hits. Why? Is there another expression for a "nested group" where my user is not directly member of? Thanks a lot!
j
Jon Bucud
03/27/2024, 3:53 PMIs there a mirrored local NetScaler group to which the policy is bound?
add aaa group NestedGroup1j
Julian Jakob
03/27/2024, 6:29 PMNo, NestedGroup1 is the example name of a AD-Nested Group where I would like to filter for. Is it necessary to put the group extraction of first flow into a local aaa group?
j
Jon Bucud
03/27/2024, 6:32 PMTo trigger policies off it, I believe so yes. Let me see if I can find documentation
Jon Bucud
03/27/2024, 6:32 PMhttps://support.citrix.com/article/CTX278960/aaa-group-expressions-in-gateway-vserver-cvpn-full-vpn-and-ica-proxy-usecases
Copy code
Note: This requirement was always applicable for CVPN and Full VPN Use cases, starting the following versions this requirement is also applicable for ICA Proxy Use case
12.1.57.x
13.0.61.xJon Bucud
03/27/2024, 6:35 PMThe way I've interpreted the above was the group extraction can extract the nested group membership, but can't do anything it unless it's a local to the ns "object". The other way is a patset vs a local aaa group, still triggering off a local ns "object"
j
Julian Jakob
03/28/2024, 8:52 AMHm I think this article is out of date? I'm always doing AAA.USER Filtering on LDAP Groups without replicating these to a local AAA NS Group. The only difference now is, it's a nested group where I want to filter of
k
Kari Ruissalo (WyW)
03/28/2024, 10:50 AMyou're seeing that group extracted for the user? (cat /tmp/aaaa.debug). Any other policies in the next factor policy label?
m
Mike Streetz (O_P)
03/28/2024, 3:28 PMare you using a search filter on your ldap server like
memberOf*:1.2.840.113556.1.4.1941:*=CN=CitrixRemote,OU=Citrix,DC=corp,DC=localMike Streetz (O_P)
03/28/2024, 3:37 PMwithout that, it won’t do anything with nested groups that you aren’t directly a member of, so that might be why it’s failing
k
Kari Ruissalo (WyW)
03/29/2024, 10:24 AMthat should cover nested groups, but I would check the aaad.debug during logon to be sure first that the groups get extracted
💯 1
Kari Ruissalo (WyW)
03/29/2024, 10:24 AMIf you're using that NO_AUTHN action with AAA.USER.IS_MEMBER ... I wouldn't use that LDAP filter, just decide whether to use the LDAP filter or the nFactor
j
Jon Bucud
03/29/2024, 2:57 PMi assumed that the nested group was being seen in the aaad.debug
j
Julian Jakob
04/02/2024, 7:38 PMYes, nested group extraction is seen in the aaad.debug.
memberOf*:1.2.840.113556.1.4.1941:*=CN=k
Kari Ruissalo (WyW)
04/03/2024, 5:58 AMThat works for me in several setups. So your flow starts with an LDAP policy, which only checks the username and does group extract, followed by a policylabel where you have bound a NO_AUTHN policy that checks for the group membership (loginschema is the default one here?) and then this is followed by a nFactor/policylabel that does what?
Kari Ruissalo (WyW)
04/03/2024, 5:58 AMif you have a flow chart (anonymized) you could share, that'd help